One of capabilities of a malicious botnet is to perform a distributed denial of service (DDoS) attack. Attacks can be performed by various methods like volumetric flooding, slow HTTP attacks or TCP protocol misuse. A DNS amplification is an example of volumetric flooding that became popular recently. It is well known that Trojans for the Windows platform with resources containing Chinese locale have a long tradition of interest in this type of attacks and lack other spying features that Trojans usually possess.

We present a survey of current trends in usage of standalone grey area tools performing DDoS for multiple platforms. The focus is put especially on Linux and FreeBSD versions. These tools are later trojanized by adding persistence using executable droppers or scripts editing crontab. The infection vector starts with automated brute-forcing of the SSH protocol, the malicious flooding tools are then deployed in the compromised system and executed. The competition for resources, such as ports and CPU time, is manifested as the initial attempt to kill and to remove other, possibly flooding, processes. Variants for Windows x86/x64 are co-distributed already with persistence and possess a debug string ‘Chicken’ appearing in the title.

The technical part of this analysis covers versions designed for several platforms and architectures. This involves behavioral aspects of initial droppers, the installation of components performing DDoS, the description of internet communication and the collection of various system and performance statistics. For a better insight, we will demonstrate several bot builders and C&C panels which have been acquired. Screenshots of publicly available advertisements promoting the charged customizability of Linux variants will be displayed.

During our analysis, we connected to the botnets and monitored several C&C servers for a certain period of time which gave us a chance to collect some statistics. Therefore we are able to present particular examples of websites and services which were flooded. We shortly discuss the motivation behind the selection of these attack preferences.